diff options
| author | truckman <truckman@FreeBSD.org> | 2016-05-16 04:43:47 +0000 |
|---|---|---|
| committer | truckman <truckman@FreeBSD.org> | 2016-05-16 04:43:47 +0000 |
| commit | 0d65936221418055dedf99ba47258f00fed0fa91 (patch) | |
| tree | 52f8d43955afbd271960139569fb93bb956be954 | |
| parent | 178e19d132e1d8b19d806afcc31f5d904edafd98 (diff) | |
| download | FreeBSD-src-0d65936221418055dedf99ba47258f00fed0fa91.zip FreeBSD-src-0d65936221418055dedf99ba47258f00fed0fa91.tar.gz | |
pdu_delete(request) frees request, so move the call after
login_new_response(request) to avoid a use-after-free error
Reported by: Coverity
Reviewed by: 1331219, 1331220
| -rw-r--r-- | usr.sbin/ctld/login.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.sbin/ctld/login.c b/usr.sbin/ctld/login.c index 3710dbc..f767d88 100644 --- a/usr.sbin/ctld/login.c +++ b/usr.sbin/ctld/login.c @@ -767,10 +767,10 @@ login_wait_transition(struct connection *conn) login_send_error(request, 0x02, 0x00); log_errx(1, "got no \"T\" flag after answering AuthMethod"); } - pdu_delete(request); log_debugx("got state transition request"); response = login_new_response(request); + pdu_delete(request); login_set_nsg(response, BHSLR_STAGE_OPERATIONAL_NEGOTIATION); pdu_send(response); pdu_delete(response); |
